Bulk SharePoint/OneDrive file access via scripting user agents

Arnold Chan@slaz

•updated Sep 8, 2026•0•0•1

This rule detects suspicious, high-volume file access or download operations in SharePoint and OneDrive. It filters for activities performed by specific user agents commonly associated with automated scripting tools (e.g., python-requests, Microsoft.Graph.Client), which indicates potential automated exfiltration or unauthorized bulk data collection.